import type { AuthLocale } from '../../i18n/keys.js';
import { type PasswordPolicy, type PasswordRuleId } from '../../password-policy.js';
/** Where a component reads its policy from. Re-read on every effect run, so props stay reactive. */
export interface PasswordPolicySource {
    /** Policy supplied by the consumer (e.g. from a `+page.server.ts` load). Wins, and skips the request. */
    policy?: PasswordPolicy;
    /** Endpoint serving `createPasswordPolicyHandler`. `null` disables the request. */
    path?: string | null;
    /** Custom fetch, forwarded from the component's `fetcher` prop. */
    fetcher?: typeof globalThis.fetch;
}
/**
 * GET the server's password policy. Returns `null` when the endpoint is not
 * mounted or unreachable — the caller then keeps {@link DEFAULT_PASSWORD_POLICY},
 * which is what an unconfigured server enforces, so the gate still matches.
 * A deployment that *has* configured `config.password` and has NOT mounted the
 * route is the one case where client and server can still disagree; that is
 * what the DEV warning names.
 */
export declare function fetchPasswordPolicy(path: string, fetcher?: typeof globalThis.fetch): Promise<PasswordPolicy | null>;
/**
 * The password policy a form should gate against: the consumer's prop if it
 * has one, otherwise the server's, otherwise the package defaults. The request
 * runs in an effect, so it never fires during SSR and never fires twice for a
 * prop-supplied policy.
 */
export declare function usePasswordPolicy(read: () => PasswordPolicySource): {
    readonly current: PasswordPolicy;
    adopt(policy: PasswordPolicy): void;
};
/** A password the server refused, in machine form (see `passwordRefusal` on the server). */
export interface PasswordRefusal {
    /** The rules the password failed, in `PASSWORD_RULES` order. */
    rules: PasswordRuleId[];
    /** The policy they were measured against — the server's, not the form's. */
    policy: PasswordPolicy;
}
/**
 * Read a password refusal out of a `validation_error` body, or `null` when the
 * body is any other failure. Read-tolerant on purpose: an older server sends
 * neither field, and the caller then falls through to the ordinary
 * code/prose chain.
 */
export declare function passwordRefusalFromBody(data: Record<string, unknown>): PasswordRefusal | null;
/**
 * The localized sentence for a refusal. Names the failing rules inside the
 * message rather than relying on the checklist beside it, because the
 * checklist can be switched off (`showRequirements={false}`) and because it is
 * the only text a screen reader reaches through the error region.
 */
export declare function passwordRefusalMessage(refusal: PasswordRefusal, t: AuthLocale): string;